India’s Digital Personal Data Protection (DPDP) Act, 2023, has moved from a future consideration to a present-day business priority. The DPDP Rules were notified in November 2025, the compliance clock is running, and any business that collects or processes personal data of people in India needs a plan. This guide outlines the key provisions of the law, clarifies which situations it covers, and highlights the initial steps you should take.
What Is the DPDP Act?
The DPDP Act is India’s first comprehensive data protection law. The (DPDP) Act, establishes guidelines for how organisations handle individuals’ digital personal data in India, including its collection, processing, storage and sharing, as well as personal data initially recorded offline and later converted into digital format.
It governs how organisations collect, use, store and share the digital personal data of individuals in India. It applies to digital data, and to non-digital data that is later digitised. It also reaches companies outside India that offer goods or services to people in India.
The law uses three key terms:
Data Principal: the individual whose data is processed (your customer, user or employee).
Data Fiduciary: the organisation that decides why and how personal data is processed (that’s you).
Data Processor: A third-party vendor or service provider that handles personal data on behalf of a Data Fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023.
DPDP Compliance Timeline: Key Dates
The law is being implemented in three distinct phases, giving businesses time to understand their legal obligations
Phase 1: November 2025
The Rules were notified on 13 November 2025, and the institutional provisions, including the Data Protection Board of India, came into force immediately.
Phase 2: November 2026
Rules on registering Consent Managers come into force on 13 November 2026. These are entities that let people give, manage and withdraw consent through a single interface.
13 May 2027
The key compliance requirements will come into effect 18 months after notification, covering user consent, data security safeguards, personal data breach reporting, children’s data protection and Data Principal rights under India’s DPDP Act. Most of your compliance work needs to be finished by this date.
Core Obligations for Data Fiduciaries
Notice and Consent
Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. You must give a plain-language notice explaining what data you collect and why, and people must be able to withdraw consent as easily as they gave it.
Purpose Limitation and Data Minimisation
Collect only what you need for the stated purpose, and delete personal data once that purpose is served, unless the law requires you to keep it.
Reasonable Security Safeguards
You must protect personal data with measures such as encryption, access controls, logging and backups. You remain responsible even when a vendor processes data for you, so your processor contracts matter.
Breach Notification
If a personal data breach occurs, you must inform affected individuals and report to the Data Protection Board. The Rules require a detailed report to the Board within 72 hours.
Children’s Data
Processing a child’s data requires verifiable consent from a parent or lawful guardian, and tracking or targeted advertising aimed at children is restricted. In October 2026, MeitY issued the DPDP (Removal of Difficulties) Order, which clarifies that this guardian-consent rule also covers persons with disabilities who have a lawful guardian. It corrects wording and adds no new obligations.
Rights of Data Principals
Individuals can ask for access to their data, correction and erasure, grievance redressal, and can nominate someone to exercise rights on their behalf. You need a working process to respond.
Significant Data Fiduciaries
Large or high-risk processors may be designated Significant Data Fiduciaries. They must appoint a Data Protection Officer and an independent data auditor, and carry out periodic data audits and impact assessments.
Penalties for Non-Compliance
Penalties can reach up to ₹250 crore for failing to maintain reasonable security safeguards, with other violations carrying their own caps. The Data Protection Board decides penalties after an inquiry, and the amount depends on the nature, gravity and duration of the breach. The cost of reputational damage often exceeds the fine.
A Practical DPDP Compliance Checklist
Map your data. List what personal data you collect, where it’s stored, who can access it, and which vendors touch it.
Review your consent flows. Rewrite notices in plain language and make withdrawal as easy as opting in.
Set retention and deletion rules. Define how long each data type is kept and automate deletion.
Tighten security. Apply encryption, role-based access and audit logs, and test them.
Build a breach response plan. Assign owners and rehearse the 72-hour reporting workflow.
Update vendor contracts. Add data processing agreements that pass your obligations on to processors.
Create a rights-request process. Provide a centralized platform for data access, correction, and deletion requests, with deadline tracking to support compliance.
Train your team. Most breaches start with human error.
How to Get Started
With the main deadline in May 2027, the best time to start is now. Begin with a data-mapping exercise and a gap assessment, then work through the checklist in order of risk. Automating consent capture, request handling and audit trails will save time and reduce errors as volumes grow.
Related Blogs
More in Security
No related blogs found in this category yet.